From 127701d9d32e568f09c775e722286e9c0b8c72ec Mon Sep 17 00:00:00 2001
From: Tomas Hozza <thozza@redhat.com>
Date: Fri, 22 May 2015 16:56:25 +0200
Subject: [PATCH] Fix coverity issues
http://cov01.lab.eng.brq.redhat.com/covscanhub/waiving/9377/
Signed-off-by: Tomas Hozza <thozza@redhat.com>
---
bin/named/server.c | 8 +++-----
lib/dns/dispatch.c | 5 +++--
lib/dns/dst_api.c | 6 ++++++
lib/dns/gen.c | 16 +++++++++++++++-
lib/dns/name.c | 8 ++------
lib/dns/nsec3.c | 4 ++--
lib/dns/rcode.c | 4 +++-
lib/isc/netaddr.c | 1 +
lib/isc/pk11.c | 21 ++++++++++++++-------
9 files changed, 49 insertions(+), 24 deletions(-)
diff --git a/bin/named/server.c b/bin/named/server.c
index 227c646..5e94660 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -8018,9 +8018,11 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) {
dns_zone_t *zone = NULL;
char classstr[DNS_RDATACLASS_FORMATSIZE];
char zonename[DNS_NAME_FORMATSIZE];
- const char *vname, *sep, *msg = NULL, *arg;
+ const char *vname, *sep, *arg;
isc_boolean_t cleanup = ISC_FALSE;
+ UNUSED(text);
+
(void) next_token(&args, " \t");
arg = next_token(&args, " \t");
@@ -8061,10 +8063,6 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) {
result = synczone(zone, &cleanup);
isc_task_endexclusive(server->task);
- if (msg != NULL && strlen(msg) < isc_buffer_availablelength(text))
- isc_buffer_putmem(text, (const unsigned char *)msg,
- strlen(msg) + 1);
-
view = dns_zone_getview(zone);
if (strcmp(view->name, "_default") == 0 ||
strcmp(view->name, "_bind") == 0)
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 5063914..c93651d 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -2278,9 +2278,10 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
/* Create or adjust socket pool */
if (mgr->spool != NULL) {
- if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2)
+ if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2) {
isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2);
isc_mempool_setfreemax(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2);
+ }
UNLOCK(&mgr->buffer_lock);
return (ISC_R_SUCCESS);
}
@@ -3765,7 +3766,7 @@ dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr,
goto fail_alloc;
dset->dispatches = isc_mem_get(mctx, sizeof(dns_dispatch_t *) * n);
- if (dset == NULL) {
+ if (dset->dispatches == NULL) {
result = ISC_R_NOMEMORY;
goto fail_lock;
}
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index d96473f..e71f202 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -1882,6 +1882,9 @@ dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
#ifdef BIND9
unsigned int flags = dst_entropy_flags;
+ if (dst_entropy_pool == NULL)
+ return (ISC_R_FAILURE);
+
if (len == 0)
return (ISC_R_SUCCESS);
@@ -1914,6 +1917,9 @@ dst__entropy_status(void) {
unsigned char buf[32];
static isc_boolean_t first = ISC_TRUE;
+ if (dst_entropy_pool == NULL)
+ return (0);
+
if (first) {
/* Someone believes RAND_status() initializes the PRNG */
flags &= ~ISC_ENTROPY_GOODONLY;
diff --git a/lib/dns/gen.c b/lib/dns/gen.c
index 6b533dd..548f892 100644
--- a/lib/dns/gen.c
+++ b/lib/dns/gen.c
@@ -335,10 +335,14 @@ insert_into_typenames(int type, const char *typename, const char *attr) {
typename);
exit(1);
}
+
strncpy(ttn->typename, typename, sizeof(ttn->typename));
- ttn->type = type;
+ ttn->typename[sizeof(ttn->typename) - 1] = '\0';
strncpy(ttn->macroname, ttn->typename, sizeof(ttn->macroname));
+ ttn->macroname[sizeof(ttn->macroname) - 1] = '\0';
+
+ ttn->type = type;
c = strlen(ttn->macroname);
while (c > 0) {
if (ttn->macroname[c - 1] == '-')
@@ -364,7 +368,10 @@ insert_into_typenames(int type, const char *typename, const char *attr) {
attr, typename);
exit(1);
}
+
strncpy(ttn->attr, attr, sizeof(ttn->attr));
+ ttn->attr[sizeof(ttn->attr) - 1] = '\0';
+
ttn->sorted = 0;
if (maxtype < type)
maxtype = type;
@@ -393,11 +400,17 @@ add(int rdclass, const char *classname, int type, const char *typename,
newtt->next = NULL;
newtt->rdclass = rdclass;
newtt->type = type;
+
strncpy(newtt->classname, classname, sizeof(newtt->classname));
+ newtt->classname[sizeof(newtt->classname) - 1] = '\0';
+
strncpy(newtt->typename, typename, sizeof(newtt->typename));
+ newtt->typename[sizeof(newtt->typename) - 1] = '\0';
+
if (strncmp(dirname, "./", 2) == 0)
dirname += 2;
strncpy(newtt->dirname, dirname, sizeof(newtt->dirname));
+ newtt->dirname[sizeof(newtt->dirname) - 1] = '\0';
tt = types;
oldtt = NULL;
@@ -436,6 +449,7 @@ add(int rdclass, const char *classname, int type, const char *typename,
}
newcc->rdclass = rdclass;
strncpy(newcc->classname, classname, sizeof(newcc->classname));
+ newcc->classname[sizeof(newcc->classname) - 1] = '\0';
cc = classes;
oldcc = NULL;
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 4fcabb1..93173ee 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -1859,7 +1859,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
0)
return (DNS_R_DISALLOWED);
new_current = c & 0x3F;
- n = 1;
state = fw_newcurrent;
} else
return (DNS_R_BADLABELTYPE);
@@ -1867,8 +1866,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
case fw_ordinary:
if (downcase)
c = maptolower[c];
- /* FALLTHROUGH */
- case fw_copy:
*ndata++ = c;
n--;
if (n == 0)
@@ -1877,9 +1874,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
case fw_newcurrent:
new_current *= 256;
new_current += c;
- n--;
- if (n != 0)
- break;
if (new_current >= biggest_pointer)
return (DNS_R_BADPOINTER);
biggest_pointer = new_current;
@@ -2398,6 +2392,8 @@ dns_name_tostring(dns_name_t *name, char **target, isc_mem_t *mctx) {
isc_buffer_usedregion(&buf, ®);
p = isc_mem_allocate(mctx, reg.length + 1);
+ if (p == NULL)
+ return (ISC_R_NOMEMORY);
memcpy(p, (char *) reg.base, (int) reg.length);
p[reg.length] = '\0';
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 935f515..86fad33 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -842,8 +842,8 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
dns_db_detachnode(db, &newnode);
} while (1);
- if (result == ISC_R_NOMORE)
- result = ISC_R_SUCCESS;
+ /* result cannot be ISC_R_NOMORE here */
+ INSIST(result != ISC_R_NOMORE);
failure:
if (dbit != NULL)
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
index 0b7fe8c..091b3c7 100644
--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
@@ -216,7 +216,9 @@ maybe_numeric(unsigned int *valuep, isc_textregion_t *source,
* isc_parse_uint32(). isc_parse_uint32() requires
* null termination, so we must make a copy.
*/
- strncpy(buffer, source->base, NUMBERSIZE);
+ strncpy(buffer, source->base, sizeof(buffer));
+ buffer[sizeof(buffer) - 1] = '\0';
+
INSIST(buffer[source->length] == '\0');
result = isc_parse_uint32(&n, buffer, 10);
diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c
index 5cce1bc..6706542 100644
--- a/lib/isc/netaddr.c
+++ b/lib/isc/netaddr.c
@@ -235,6 +235,7 @@ isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) {
nbytes = prefixlen / 8;
nbits = prefixlen % 8;
if (nbits != 0) {
+ INSIST(nbytes < ipbytes);
if ((p[nbytes] & (0xff>>nbits)) != 0U)
return (ISC_R_FAILURE);
nbytes++;
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
index 015bff2..de4479b 100644
--- a/lib/isc/pk11.c
+++ b/lib/isc/pk11.c
@@ -130,7 +130,10 @@
#include <pkcs11/cryptoki.h>
#include <pkcs11/pkcs11.h>
-#define PINLEN 32
+/* was 32 octets, Petr Spacek suggested 1024, SoftHSMv2 uses 256... */
+#ifndef PINLEN
+#define PINLEN 256
+#endif
#ifndef PK11_NO_LOGERR
#define PK11_NO_LOGERR 1
@@ -163,7 +166,7 @@ struct pk11_token {
char manuf[32];
char model[16];
char serial[16];
- char pin[PINLEN];
+ char pin[PINLEN + 1];
};
static ISC_LIST(pk11_token_t) tokens;
@@ -498,7 +501,9 @@ pk11_get_session(pk11_context_t *ctx, pk11_optype_t optype,
/* Override the token's PIN */
if (logon && pin != NULL && *pin != '\0') {
- memset(token->pin, 0, PINLEN);
+ if (strlen(pin) > PINLEN)
+ return ISC_R_RANGE;
+ memset(token->pin, 0, PINLEN + 1);
strncpy(token->pin, pin, PINLEN);
}
@@ -1099,7 +1104,7 @@ pk11_parse_uri(pk11_object_t *obj, const char *label,
char *uri, *p, *a, *na, *v;
size_t len, l;
FILE *stream = NULL;
- char pin[PINLEN];
+ char pin[PINLEN + 1];
isc_boolean_t gotpin = ISC_FALSE;
isc_result_t ret;
@@ -1207,10 +1212,12 @@ pk11_parse_uri(pk11_object_t *obj, const char *label,
ret = isc_stdio_open(v, "r", &stream);
if (ret != ISC_R_SUCCESS)
goto err;
- memset(pin, 0, PINLEN);
- ret = isc_stdio_read(pin, 1, PINLEN - 1, stream, NULL);
+ memset(pin, 0, PINLEN + 1);
+ ret = isc_stdio_read(pin, 1, PINLEN + 1, stream, &l);
if ((ret != ISC_R_SUCCESS) && (ret != ISC_R_EOF))
goto err;
+ if (l > PINLEN)
+ DST_RET(ISC_R_RANGE);
ret = isc_stdio_close(stream);
stream = NULL;
if (ret != ISC_R_SUCCESS)
@@ -1238,7 +1245,7 @@ pk11_parse_uri(pk11_object_t *obj, const char *label,
DST_RET(ISC_R_NOTFOUND);
obj->slot = token->slotid;
if (gotpin) {
- memmove(token->pin, pin, PINLEN);
+ memmove(token->pin, pin, PINLEN + 1);
obj->reqlogon = ISC_TRUE;
}
--
2.1.0